Australia’s federal digital identity reform: parliamentary review
The Federal Government’s Digital ID Bill would provide important legal guardrails for the coming wave of digital identity initiatives. However, the Bill needs to be strengthened to improve privacy and other human rights protections, according to a submission by the Human Technology Institute.
‘Digital identity’ is technology that can verify a person’s identity, often via an individual’s smartphone using facial verification and other methods. Where the technology is well designed, it allows people to prove who they are to a government agency or other organisation, without the need for face-to-face interactions or the organisation taking copies of a person’s driver’s licence, passport etc.
Introduced to Parliament in late 2023, this Bill would pave the way for significant new digital identity initiatives. The Digital ID Bill would:
extend privacy protections beyond currently federal privacy law—this is needed for the protection of sensitive information, including biometric information
provide for a number of external oversight mechanisms, to identify and address problems with the operation of digital ID schemes
provide consequences for non-compliance with the requirements of this proposed law
enable choice for individuals, since using a digital ID is voluntary
enable rules to be made regarding accessibility, technical standards and redress.
In its submission to the Senate Economic Legislation Committee, HTI has made a number of recommendations to improve the Bill , including:
Legislative consistency. Australia’s approach to digital identity is fragmented, with this Bill being one part of the Government’s Digital ID system. Other parts are governed by the Identity Verification Services Act 2023 (Cth) and interact with the Privacy Act 1988 (Cth) which the Government has indicated it plans to amend soon. That fragmentation increases when you consider the overlapping state and territory digital ID systems. There is a need to adopt an integrated and coordinated approach to digital identity across all Australian jurisdictions. Privacy Act reforms must also be passed as soon as possible to prevent legislative inconsistency.
Privacy protections – including use limitations for personal data. A number of the privacy provisions in the Bill should be tightened to ensure that protections are robust and reliable. For example, the Bill would allow police and other law enforcement bodies access to personal information from digital identity schemes, far beyond what would be necessary to combat serious crimes. HTI’s submission argues that law enforcement should be able to access such personal information only with careful protections, such as when police obtain a judicial warrant to investigate a serious crime.
Consent and voluntariness. Creating and using a digital ID will be voluntary, which gives individuals the choice to opt out. The Bill should also include a guarantee of ongoing equal access to services for those who make this choice, to ensure genuine consent.
Accessibility and non-discrimination. The Bill should include stronger protections for accessibility for people with disability and others – including by explicitly taking into account the human rights of groups that may be adversely affected by the scheme.
Redress. The Bill would allow for a redress mechanism to be set up through regulations. Ideally, a redress mechanism would be required by the primary legislation, include provisions for individual remedies, and provide a simple and accessible avenue for complaints.
The Senate Economics Legislation Committee is due to report by 28 February 2024.